I agree with you David, I tried mmnormalize but I wasn't able to make it work.
I was assigning to all the local variables (for example: set $.environment = $!environment ) the variables extracted by mmnormalize and they were always empty. I checked my rule using lognormalizer and the output field was correct so the real problem was import those into the template. If you have a working example I'd like to see it. Regards L. On Fri, Oct 6, 2017 at 3:10 PM, David Lang <da...@lang.hm> wrote: > On Fri, 6 Oct 2017, Luigi Tagliamonte wrote: > > @David thank you I made it works without mmnormalize, just using rsyslog >> functions, here is the snippet for somebody reference: >> >> set $.environment = field($syslogtag,"-",3) ; >> set $.servertype = field($syslogtag,"-",4) ; >> set $.serverid = field($syslogtag,"-",6) ; >> set $.rawmsg = replace($msg, " app:backend " , "") ; ## removing >> tag applied by the source >> > > This works, but I'd lay odds that one mmnormalize call would be faster > than repeatedly parsing the string with the field() function, let alone the > cost of the replace() function. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
